An improper control of file names used in PHP include/require statements in ThemeREX DroneX 1.1.12 and earlier allows attackers to manipulate the file path argument, leading to local file inclusion. This flaw is classified under CWE‑98 and can give an attacker the ability to read sensitive files or execute arbitrary code if the included files are writable or contain PHP code.

WordPress installations utilizing the ThemeREX DroneX theme with brand versions through 1.1.12 are impacted. No specific WordPress core or other theme versions are listed as affected.

The vulnerability has a CVSS score of 8.1, indicating high severity, while the EPSS score is less than 1 %, suggesting relatively low current exploitation probability. It is not listed in the CISA KEV catalog. The likely attack vector is remote, where an attacker supplies a crafted request or configuration value to the theme that is directly passed to a PHP include/require function. Successful exploitation could result in disclosure of system files or execution of arbitrary code, depending on the attacker’s needs and the server environment.